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Intellectual Property Rights 
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converged Services and Protocols for Advanced Networking (TISPAN). 
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Scope 



The requirement for provision of lawful interception for all Communication Service Providers (CSP) is described in 
TS 101 331 [3] and the present document gives the stage 1 and stage 2 definition for provision of an interception 
capability in TISPAN NGN Rl. 

The present document specifies the stage 1 and stage 2 model for Lawful Interception (LI) of TISPAN NGN services as 
specified by TR 180 001 [5] and covering the following services explicitly: 

• PSTN/ISDN emulation services (non IMS); and 

• IMS based services. 

The provisions in the present document apply only when the target of interception is an NGN user identified as 
specified in TS 184 002 [6], and when the network supplying services on behalf of the CSP is an NGN as specified by 
TISPAN in TR 180 001 [5] and ES 282 001 [1]. 

A guide to the application of the handover specifications is given in informative annexes. 

NOTE: Handover aspects are not specified in the present document but are described in TS 133 108 [8], 
ES 201 671 [2] and TS 102 232 [4]. 



References 



The following documents contain provisions which, through reference in this text, constitute provisions of the present 
document. 

• References are either specific (identified by date of publication and/or edition number or version number) or 
non-specific. 

• For a specific reference, subsequent revisions do not apply. 
For a non-specific reference, the latest version applies. 



• 



Referenced documents which are not found to be publicly available in the expected location might be found at 
http://docbox.etsi.org/Reference . 

NOTE: While any hyperlinks included in this clause were valid at the time of publication ETSI cannot guarantee 
their long term validity. 

[1] ETSI ES 282 001: "Telecommunications and Internet converged Services and Protocols for 

Advanced Networking (TISPAN); NGN Functional Architecture Release 1". 

[2] ETSI ES 201 671 (V2.1.1): "Telecommunications security; Lawful Interception (LI); Handover 

Interface for the lawful interception of telecommunications traffic". 

[3] ETSITS 101 331 (Vl.2.1): "Lawful Interception (LI); Requirements of Law Enforcement 

Agencies". 

[4] ETSI TS 102 232 V 1 .4. 1 : " Lawful Interception (LI); Handover specification for IP delivery" . 

[5] ETSI TR 180 001: "Telecommunications and Internet converged Services and Protocols for 

Advanced Networking (TISPAN); NGN Release 1; Release definition". 

[6] ETSI TS 184 002: "Telecommunications and Internet Converged Services and Protocols for 

Advanced Networking (TISPAN); Identifiers (IDs) for NGN". 

[7] ETSI TS 133 107: "Universal Mobile Telecommunications System (UMTS); 3G security; Lawful 

interception architecture and functions". 

[8] ETSI TS 133 108: "Universal Mobile Telecommunications System (UMTS); 3G security; 

Handover interface for Lawful Interception (LI)". 
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[9] ETSI TR 102 528: " Lawful Interception (LI); Interception domain Architecture for IP networks". 

[10] ETSI ES 282 002: "Telecommunications and Internet converged Services and Protocols for 

Advanced Networking (TISPAN); PSTN/ISDN Emulation Sub-system (PES); Functional 
architecture". 

[11] ETSI ES 282 007: "Telecommunications and Internet converged Services and Protocols for 

Advanced Networking (TISPAN); IP Multimedia Subsystem (IMS); Functional architecture". 

[12] ETSI TS 182 012: "Telecommunications and Internet converged Services and Protocols for 

Advanced Networking (TISPAN); IMS-based PSTN/ISDN Emulation Subsystem; Functional 
architecture". 



3 Definitions, and abbreviations 

3.1 Definitions 

For the purposes of the present document, the terms and definitions given in ES 201 671 [2] and the following apply: 

Content of Communication (CC): information exchanged between two or more users of a telecommunications 
service, excluding intercept related information 

NOTE: This includes information which may, as part of some telecommunications service, be stored by one user 
for subsequent retrieval by another. 

Handover Interface (HI): physical and logical interface across which the interception measures are requested from 
Communications Service Provider (CSP), and the results of interception are delivered from a CSP to a law enforcement 
monitoring facility 

interception: action (based on the law), performed by a CSP, of making available certain information and providing 
that information to a law enforcement monitoring facility 

interception interface: physical and logical locations within the CSP telecommunications facilities where access to the 
content of communication and intercept related information is provided 

NOTE: The interception interface is not necessarily a single, fixed point. 

intercept related information: collection of information or data associated with telecommunication services involving 
the target identity, specifically communication associated information or data (e.g. unsuccessful communication 
attempts), service associated information or data and location information 

internal network interface: network's internal interface between the Internal Intercepting Function (IIF) and a 
mediation device 

Law Enforcement Agency (LEA): organization authorized by a lawful authorization based on a national law to 
request interception measures and to receive the results of telecommunications interceptions 

Law Enforcement Monitoring Facility (LEMF): law enforcement facility designated as the transmission destination 
for the results of interception relating to a particular interception subject 

mediation device: equipment, which realizes the mediation function 

Mediation Function (MF): mechanism which passes information between a network operator, an access provider or 
service provider and a handover interface, and information between the internal network interface and the handover 
interface 
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target identity: technical identity (e.g. the interception's subject directory number), which uniquely identifies a target 
of interception 

NOTE: One target may have one or several target identities. 



3.2 



Abbreviations 



For the purposes of the present document, the following abbreviations apply: 

AF Administration Function 

CC Content of Communication 

CCCI Content of Communication Control Interface 

CCTF Content of Communication Trigger Function 

CCTI Content of Communication Trigger Interface 

CR Change Request 

CSP Communications Service Provider 

DP Delivery Function 

FE Functional Entity 

FES For Further Study 

GSN GPRS Support Node 

HI Handover Interface 

HIl Handover Interface Port 1 (for Administrative Information) 

HI2 Handover Interface Port 2 (for Intercept Related Information) 

HI3 Handover Interface Port 3 (for Content of Communication) 

IIF Internal Interception Function 

IMS IP Multimedia Core Network Subsystem 

INI Internal Network Interface 

IRI Intercept Related Information 

LEA Law Enforcement Agency 

LEMF Law Enforcement Monitoring Facility 

LI Lawful Interception 

ME Mediation Function 

NGN Next Generation Network 

NGN-Rl NGN Release 1 

PES PSTN/ISDN Emulation Subsystem 

Pol Point of Interception 

PSTN Public Switched Telephone Network 

RTP Real Time Protocol 

URI Universal Resource Identifier 

URL Universal Resource Locator 



Interception in the NGN 



4.1 



LI architecture model 



The architecture for lawful interception consists of a Point of Interception (Pol) for each of the signalling plane and the 
transport plane, collocated with an NGN Functional Entity (NGN FE) (the specific NGN FE varies with the service 
being intercepted), that delivers intercepted material to a Mediation Function (ME). The ME acts to mediate between the 
nationally specified handover interface and the internal interception interface of the NGN as specified in the present 
document. 

The target is a specialist NGN user that receives service from the NGN. 

NOTE 1: A service offered to the NGN user may invoke many NGN-FEs. 

NOTE 2: There are a number of terms used across ETSI to refer to the various functions outlined in the first 

paragraph of this clause (4.1). The ME is also known as a Delivery Function (DF) in 3GPP documents, 
the Internal Network Interception interfaces are also referred to in 3GPP as X interfaces. 
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The LI capability in the NGN shall always be available and shall be invoked on receipt of instruction from the Law 
Enforcement Agency or its authorizing agency. The functions of the LI capability shall only be visible to, and their 
operation shall only be invoked by, authorized parties within the NGN and shall not alter or be impacted by the 
operation of any other functional entity in the NGN. 



4.2 LI reference model 

The present document adopts the generic reference model for the interception domain from TR 102 528 [9], its internal 
intercept functions, IRI-IIF, CCTF, and CC-IIF, and the internal interfaces INIl, INI2, INI3, CCTI and CCCI as shown 
in figure 1 . 
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LEA DOMAIN 
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INIIb INIIa 
' ' 

IRI Internal Intercept 
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Mediation 
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Administration 
Function 
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NOTE: Interfaces INI1, INMa, INMb, INMc, CCTF, CCTI and CCCI are not defined in the present document but 
are shown in the figure for completeness. 

Figure 1 : Reference Model for Lawful Interception from TR 102 528 [9] 

The reference model depicts the following functions and interfaces: 

Intercept Related Information Internal Intercept Function (IRI-IIF) generates signalling intercept material. 

Content of Communication Internal Intercept Function (CC-IIF) generates content intercept material. 

Content of Communication Trigger Function (CCTF) controls the CC-IIF. 

Internal interface INIl carries provisioning information from the Lawful Interception Administration Function 
(AF) to the Internal Intercept Functions (IIF). 

Internal interface INI2 carries Intercept Related Information (IRI) from the IRI-IIF to the MF. 

Internal interface INI3 carries Content of Communication (CC) information from the CC-IIF to the MF. 

Content of Communication Trigger Interface (CCTI) carries trigger information from the IRI-IIF to the CCTF. 
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• Content of Communication Control Interface (CCCI) carries controls information from the CCTF to the 
CC-IIF. 

The reference model introduces the CCTF FE that may be used to in a number of configurations to allow for the 
provisioning of CC-IIF in an IP network. The location of the CCTF is not defined in the present document but 
considered configuration options are as follows: 

CCTF co-located with the LIAF: INIlb is internal to the AF and CCTF. 

CCTF co-located with the IRI-IIF: CCTI is internal to the IRI-IIF and CCTF. 

CCTF co-located with the IRI-IIF and CC-IIF: CCTI and CCCI are internal to the IRI-IIF, CCTF and CC-IIF. 

CCTF co-located with the MF: CCTI is merged with INI2. 

A stand alone CCTF: Both CCTI and CCCI are external interfaces. 

A complete explanation of the functions and interface is found in clause 4 of TR 102 058 [9]. 



4.3 Content of interception 



The point of interception shall provide the following data when available in the intercepting network from the 
communication of the target: 

• Date and time of interception. 

• Identity of the target and the correspondents of the target. 

• Location of the target if available. 

• Activity of the target. 

NOTE: Whilst each element of the interception may be described separately they may be delivered in 

combination, or may be delivered implicitly if no changes are reported (e.g. if location is not changed this 
knowledge may be delivered implicitly but when location is changed it may be explicitly reported). 

5 Interception of non-IIVIS PSTN/ISDN Emulation 

Subsystem (PES) 

5.1 Architecture for interception of PES 

The Point of Interception shall be at premises of the CSP, i.e. IRI-IIF and CC-IIF shall reside in equipment under full 
control (physical access, etc.) of the CSP. 

Figure 1 (in clause 4.2) identifies the generic architecture for LI. The specific provision of the CC-IIF and IRI-IIF in the 
NGN for PES services is as shown in figure 2. This architecture for LI applies to a PES whose architecture conform to 
ES 282 002 [13]. 
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NOTE: 



Location of CC-IIF is subject to implementation and not all possible options need to be implemented. 
Figure 2: Reference architecture for interception in the PES environment 



The point of interception (as defined in clause 4) with respect to IRI, the IRI-IIF, should be implemented in the 
NGN-FE that hosts the service state machine. 

The point of interception (as defined in clause 4) with respect to CC, the CC-IIF, should be implemented in a 
mediastream entity, e.g. Border Gateway. 



6 Interception of IMS 

6.1 Architecture for interception of IIVIS 

The Point of Interception shall be at premises of the CSP, i.e. IRI-IIF and CC-IIF shall reside in equipment under full 
control (physical access, etc.) of the CSP. 

Figure 1 (in clause 4.2) identifies the generic architecture for LI. The specific provision of the CC-IIF and IRI-IIF in the 
NGN for IMS services is as shown in figure 3. This architecture for LI applies to the IMS subsystem as described in 
ES 282 007 [llJandTS 182 012 [12]. 



ETSI 



11 



ETSI TS 187 005 VI .1 .1 (2006-12) 



„native IMS" Subsystem 
Control 



CCCI 



Targets 





IRf 


cc 


SIP 




UDP 


RTP 


UDP 




P 


1 



Media- 
stream 
Entity 



CC Trigger Function 



I CCTI 



IRI Internal Intercept 
Function 



CC Internal 
Intercept 
Function 



IP 



IP 



INI3 



SIP 



UDP 



IP 



INI2 



Mediastream 



Figure 3: Reference architecture for interception in thie IIUIS environment 

6.2 Activation, deactivation and interrogation 

The principles described in TS 133 107 [7] apply, with the exception that the list of target identities is restricted to be a 
SIP URI or a TEL URL. 

6.3 Intercept Related Information 

Communications to or from a targeted subscriber and communications initiated on behalf of a targeted subscriber are 
intercepted at the P-CSCF or S-CSCF as described in TS 133 107 [7]. 

The stage 2 definition for interception of IMS found in TS 133 107 [7] shall apply for TISPAN NGN Rl. Annex A 
specifies the parts of TS 133 107 [7] that apply. 

NOTE 1 : When IMS is providing a PES service the interception service identified above and defined in 

TS 133 107 [7] still applies. In addition, the AGCF may be used as an alternative point of interception. 

NOTE 2: If the IMS is used for the support of transit communication and national LI requires their interception then 
the interception of communications in transit may take place at the IBCF or MGCF depending on the 
characteristics of the interconnected networks involved in the communication. 



6.4 Content of Communication 

Interception of the content of communications takes place at transport processing functional entities identified in the 
TISPAN NGN Rl architecture (ES 282 001 [1]). Transport processing entities that may provide the CC-IIF are: 

An Access Media Gateway Function (A-MGF). 

A Core Border Gateway Function (C-BGF). 

An Interconnect Border Gateway Function (I-BGF). 

A Trunking Media Gateway Function (T-MGF). 

A Multimedia Resource Function Processor (MRFP). 

NOTE 1 : Interception at an A-MGF, C-BGF or MRFP takes place when the target of interception is a subscriber of 
the IMS network. 
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NOTE 2: If the IMS is used for the support of transit communication and national LI requires their interception then 
the interception of communications in transit may take place at the I-BGF or T-MGF depending on the 
characteristics of the interconnected networks involved in the communication. 

When the interception of communication contents takes place at a C-BGF or I-BGF, interactions between the IRI-IIF 
and the CC-IIF takes place through the SPDF or the MF. The SPDF or the MF plays the role of a CCTF as identified in 

clause 4.3. 

When the interception of communication contents takes place at an A-MGF or T-MGF, the AGCF or MGCF plays the 
role of the IRI-IIF, and the CCTF (as identified in clause 4.3) is located in the AGCF, MGCF or MF. 

When the interception of communication contents takes place at an MRFP, the associated MRFC and an Application 
Server Function collectively, or the MF, play the role of a CCTF. The ASF controls the MRFC via the S-CSCF. In order 
to ensure that the Application Server gets involved in the communications subject to interception, the Administration 
Function (ADMF) provisions the S-CSCF with the address of the Application Server or creates an appropriate Initial 
Filter Criteria in the targeted subscriber's profile in the UPSF. 

The instances in the network where the interception takes place (Point of Interception) shall be at premises of the CSP, 
i.e. IRI-IIF and CC-IIF shall reside in equipment under full control (physical access, etc.) of the CSP. 



7 Identification of target of interception 

7.1 ISDN/PSTN services 

In the context of PSTN/ISDN emulation and services, the target shall be identified in the service domain by a globally 
unique E.164 identity. 

NOTE: The PES offers seamless ISDN/PSTN service to existing core network customers who will remain 
identified by their E. 164 identity that may be mapped to a system unique SIP- identity. 

7.2 IMS services 

IMS service users shall be identified by either a SIP-url or a tel-url [6]. 



8 Security considerations 



The guidelines for security identified in TS 101 331 [3] apply. The provision and actions of the interception measure 
should be confidential and not discoverable, or alterable, by unauthorized parties. 
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Annex A (normative): 

Endorsement statement for TS 133 107 

For the stage 2 definition of the interception of IMS and generic IP subsystem parts of TS 133 107 [7] apply 
normatively in the context of TISPAN NGN. This annex summarizes those parts of TS 133 107 [7] that apply in the 
context of TISPAN NGN LI. 

NOTE: Where no specific endorsement statement is given the text in the endorsed document is considered to 
have only background relevance and not to form part of the normative specification for NGN-Rl 
interception. 



Clause 


Applicability in TISPAN NGN R1 


1 




2 




3 




4 


Figure 1d applies 


5 




6 


Does not apply 


7 


Does not apply 


7A 


Applies in full 


7A.1 


Does not apply (refers only to GSNs) 


7A.2 


Applies in full 


7A.3 


Applies in full with extensions defined in the present document 


7A.4 


Applies in full 


7A.5 


Does not apply (service defined only for cellular network) 


8 




9 


Does not apply 


Annex A 


Does not apply 


Annex B 


Does not apply 


Annex C 




Annex D 


Does not apply 


Annex G 


Does not apply (informative annex showing history of CRs applied to the document) 






NOTE: Annexes E and F do not exist in TS 1 33 1 07 [7]. 
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Annex B (informative): 

Endorsement statement for TS 133 108 

NOTE 1 : This annex is provided for information pending a full stage 3 mapping from TISPAN NGN to 
TS 133 108 [8]. 

NOTE 2: The endorsements stated are indicative and further work is required to fully analyse the data and 
operations in TS 133.108 and how they should apply in TISPAN NGN. 

This annex summarizes those parts of TS 133 108 [8] that apply in the context of TISPAN NGN LI. 

NOTE 3: Where no specific endorsement statement is given the text in the endorsed document is considered to 
have only background relevance and not to form part of the normative specification for NGN-Rl 
interception. 
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Clause 


Applicability in TISPAN NGN R1 


1 




2 




3 




4 




4.1 




4.2 




4.3 




4.4 




4.4.1 


Applies in full 


4.4.2 




4.5 


Applies in full 


4.5.1 


Applies in full 


4.5.2 


Applies in full 


4.5.3 


Applies in full 


5 


Does not apply 


6 




7 




7.1 




7.1.1 




7.1.2 




7.1.3 


Correlation to the relevant CC Is necessary 


7.2 




7.3 




7.4 




7.5 


Yes / for correlation ASN.1 parameter correlation had to be used 


7.5.1 


Yes / for correlation ASN.1 parameter correlation had to be used 


7.6 




Annex A 




Annex B 


Requires detail study of ASN.1 to confirm applicability. IVIay not apply 


B.I 


IVIay not apply 


B.2 


IVIay not apply 


B.3 


IVIay not apply 


B.3a 


IVIay not apply 


B.4 


IVIay not apply 


B.5 


IVIay not apply 


B.6 


IVIay not apply 


Annex C 




Annex D 




Annex E 




Annex F 




Annex G 




Annex H 


Applies in full 


Annex J 


Does not apply 


Annex K 


Does not apply (informative annex showing history of CRs applied to the document) 






NOTE: W 
ha 
mc 


lereas the scope of the present document Is interception in the NGN domain the scope of TS 1 33 1 08 [8] is 
ndover for the PLIVIN, the data emanating from the PLMN is described and covers a range of capabilities 
)re specific than those of the NGN (although the NGN is a superset of the capabilities that form the PLIVIN). 
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Annex C (informative): 

Endorsement statement for TS 102 232 



NOTE 1 : This annex is provided for information pending a full stage 3 mapping from TISPAN NGN to 

TS 102 232 [4]. 

NOTE 2: The endorsements stated are indicative and further work is required to fully analyse the data and 
operations in TS 102 232 [4] and how they should apply in TISPAN NGN. 
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Annex D (informative): 

Endorsement statement for ES 201 671 



NOTE 1 : This annex is provided for information pending a full stage 3 mapping from TISPAN NGN to 
ES 201 671 [2]. 

NOTE 2: The endorsements stated are indicative and further work is required to fully analyse the data and 
operations in ES 201 671 [2] and how they should apply in TISPAN NGN. 



Clause 


Title 


Applicability in 
TISPAN NGN R1 


1 


Scope 




2 


References 




3 


Definitions and abbreviations 




3.1 


Definitions 




3.2 


Abbreviations 




4 


General requirements 




4.1 


Basic principles for the Handover Interface 


Applies in full 


4.2 


Legal requirements 


Applies in full 


4.3 


Functional requirements 


Applies in full 


5 


Overview of Handover Interface 


Applies in full 


5.1 


Handover Interface port 1 (HI1) 


No: national implementation 


5.1.1 


IVIanual interface 


No: national implementation 


5.1.2 


Electronic interface 


No: national implementation 


5.2 


Handover Interface port 2 (HI2) 


Applies in full 


5.3 


Handover Interface port 3 (HIS) 


Applies in full 


6 


Specific identifiers for LI 


Applies in full 


6.1 


Lawful Interception Identifier (LIID) 


Applies in full 


6.2 


Communication Identifier (CID) 


Applies in full 


6.2.1 


Network Identifier (NID) 


Applies in full 


6.2.2 


Communication Identity Number (CIN) - optional 


Applies in full 


7 


HI1 : Interface port for administrative information 




7.1 


Information for the activation of lawful interception 


Applies in full 


7.2 


LI notifications towards the LEMF 


No: national implementation 


8 


HI2: Interface port for Intercept Related Information 




8.1 


Data transmission protocols 




8.1.1 


Application for IRI (HI2 information) 




8.2 


Types of IRI records 




9 


HI3: Interface port for Content of Communication 




10 


Performance and quality 




10.1 


Timing 




10.2 


Quality 




11 


Security aspects 


Advisable 


11.1 


Security properties 


Advisable 


11.2 


Security mechanisms 


Advisable 


12 


Quantitative aspects 


national matter 


Annex A 
(normative): 


Circuit switched network handover 


Applies in full 


Annex B 
(normative): 


Packet switched network handover 


Applies in full 


Annex C 
(normative): 


HI2 Delivery mechanisms and procedures 




C.I 


ROSE 




C.2 


FTP 




Annex D 
(normative): 


Structure of data at the Handover Interface (ASN.1) 




Annex E 
(informative): 


Use of subaddress and calling party number to carry correlation 
information 


National matter 


Annex F 
(informative): 


GPRS HIS Interface 




Annex G 
(informative): 


LEIVIF requirements - handling of unrecognized fields and parameters 
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Clause 


Title 


Applicability in 
TISPAN NGN R1 


Annex H 
(informative): 


IP Multimedia Subsystem (IIVIS) handover 




Annex 1 
(informative): 


Latest ASN.1 module versions 


No 


Annex J 
(informative): 


Bibliograpliy 




Annex K 
(informative): 


Change Request history 


No 
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Annex E (informative): 

ISDN/PSTN LI reference configurations 

The figures contained in this annex identify a number of reference configurations for lawful interception in TISPAN 
NGN networks. Interception configurations for communications to or from a targeted TISPAN NGN subscriber are 
shown in figures E.l, E.2 and E.3. Interception of communications in transit are shown in figures E.4 and E.5. 
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Figure E.l : Interception at the edge (case 1) 
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Figure E.2: Interception at the edge (case 2) 
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Figure E.3: Interception in the core 




Figure E.4: Interception of communications in transit (TDIUI case) 
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l-BGF 



Figure E.5: Interception of communications in transit (IP case) 
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Annex F (informative): 
Selection of handover interface 



Handover of intercepted material should be made by reference to one or more of the following specifications: 

• ES 201 671 [2]: Handover Interface for the lawful interception of telecommunications traffic. 

• TS 133 108 [8]: Handover interface for Lawful Interception. 

• TS 102 232 [4]: Handover specification for IP delivery. 

NOTE: National specifications may be used instead of any of the ETSI specifications cited above. 

Figure F. 1 illustrates configurations of mediation function to map the Handover Interface to the intercepted data that are 
subject to bilateral agreement between Network Provider and LEA. 
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I— Mediastream Adaptation 



Control CC-link according 
to ETSI ES 201 671 



I— Mediastream Adaptation 



CC-Mediatlon Function 



IRI according to 

ETSI ES 201 671 

across HI2 



IRI according to 
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combination with 

ETSI TS 102 232 
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CC according to 
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across HI3 



NOTE 1 : CS interception formats from the NGN may map to CS capabilities in TS 1 33 1 08 but there may be a 

requirement for extensions to TS 133 108 in some instances. 
NOTE 2: IMS interception formats from the NGN may map to IIVIS capabilities in TS 133 108 but there may be a 

requirement for extensions to TS 133 108 in some instances. 
NOTE 3: SIP interception formats from the NGN map to IMS capabilities in TS 133 108 but there may be a 

requirement for extensions to TS 133 108 in some instances. 

Figure F.1 : Reference Model for LI Mediation Function 
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